CVE-2026-64066

The CVE-2026-64066 entry describes a Linux kernel issue in the netfs component, specifically netfs_read_to_pagecache(). The vulnerability arises because the function does not pause the generation of new subrequests when an already-issued subrequest fails. A fix was implemented to pause subrequest...

CVE-2026-64067

The CVE-2026-64067 issue concerns the Linux kernel netfs component, where stream->subrequests was accessed without proper memory barriers. The vulnerability arises from lockless access to the list of subrequests, allowing race conditions when netfs_collect_read_results() and netfs_collect_writ...

CVE-2026-64065

CVE-2026-64065 concerns a Linux kernel issue in the netfs path: a VM_BUG_ON_FOLIO() problem within netfs_write_begin() can trigger a kernel BUG at mm/filemap.c:1504 (observed as an Oops with a reproduction via generic/013). The provided descriptions indicate this is a resolved vulnerability in th...

CVE-2026-64064

The CVE-2026-64064 entry concerns a Linux kernel netfs issue where netfs_invalidate_folio() could leave a folio’s dirty state inconsistent after truncation, potentially causing a read path (netfs_read_folio) to oops when mmap reads a dirty folio. A fix was implemented to call folio_cancel_dirty()...

CVE-2026-64063

CVE-2026-64063 concerns the Linux kernel netfs subsystem, where streaming writes could partially overwrite dirty folios without correctly updating state. The issue occurred when a partially written streaming page was overwritten by a subsequent write: netfs_perform_write() could copy over the pag...

CVE-2026-64062

The CVE-2026-64062 issue affects the Linux kernel netfs subsystem, specifically a deadlock risk in write-through mode. The fix in netfs_advance_writethrough() ensures the supplied folio is always unlocked and marked dirty if not yet at the end; however, writeback cannot occur until the folio is d...

CVE-2026-64061

The CVE-2026-64061 entry concerns a use-after-free in the Linux kernel netfs layer (netfs_read_gaps) where the sink page is prematurely released during a network read, enabling memory corruption. The issue was observed via KASAN in a cifsd-based trace and is described across multiple vendors (Red...

CVE-2026-64060

In the Linux kernel netfs subsystem, CVE-2026-64060 fixes a leak of the request reference in netfs_write_begin() when an error occurs in netfs_wait_for_read(). The issue was resolved by adjusting error handling to avoid leaking the request’s ref. This entry contains concrete details about the aff...

CVE-2026-64059

The CVE affects the Linux kernel netfs code, specifically netfs_perform_write(), where folio->private was not reliably managed across NULL, NETFS_FOLIO_COPY_TO_CACHE, and netfs_folio/group pointers. This could lead to multiple attachments of private data, folio ref leaks, and leaks of netfs_fo...

CVE-2026-64057

The CVE-2026-64057 entry concerns the Linux kernel AFS (Andrew File System) subsystem and a locking flaw around symbolic links processed by afs_get_link(). The root causes described across sources are: (1) no locking around afs_read_single() to prevent races between concurrent ->get_link() cal...

CVE-2026-64058

The CVE-2026-64058 issue affects the Linux kernel netfs component, specifically netfs_read_folio(), which did not wait for ongoing writeback to finish. The root cause was that folio->private could be cleaned up by the collector before the writeback flag was cleared, leading to unreliable trust...

CVE-2026-64056

The CVE covers a Linux kernel issue in the Cortina ethernet driver. The RX socket buffer (SKB) used to assemble fragments in gmac_rx() was a static local variable, which could race on devices with two ethernet ports (Gemini) when both ports are active. The fix makes the RX SKB a per-port variable...

CVE-2026-64055

The CVE-2026-64055 issue is in the Linux kernel ethernet cortina driver (gmac_rx NAPI poll). A fragment counter (frag_nr) used to assemble SKB fragments could be reset to zero when the ring buffer emptied during a poll, leaving an incomplete SKB. The fix makes the RX fragment counter part of the ...

CVE-2026-64054

CVE-2026-64054 concerns the Linux kernel net: shaper GROUP request handling. The issue in net_shaper_nl_group_doit() failed to deduplicate NET_SHAPER_A_LEAVES entries, causing the same old-parent pointer to be added twice to old_nodes[]. The cleanup loop could then double-free the same parent, pa...

CVE-2026-64052

Technical details (affected product/component, root cause, impact, affected versions, or remediation specifics) are not publicly available in the provided documents. Monitor for updates as more information may be released or updated.

CVE-2026-64053

The CVE-2026-64053 issue lies in the Linux kernel block layer: bio_integrity_copy_user() overwrites bip_vcnt, and bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce segment. Writing with nr_vecs can violate bip_vcnt

CVE-2026-64051

The issue is in the Linux kernel’s accel/qaic driver. A bounds check was missing in remap_pfn_range called by qaic_gem_object_mmap, allowing (re)mapping beyond the VMA when the BO is large. This can yield use-after-free if munmap() only unmaps the VMA while extra mappings remain, enabling potenti...

CVE-2026-64050

CVE-2026-64050 affects the Linux kernel DRM MSM DPU teardown path. The vulnerability arises from mixing devm and drmm functions, which can cause a use-after-free when userspace holds a reference to the DRM device during driver teardown; WB connector data allocated with devm_kzalloc() may be destr...

CVE-2026-64049

In the Linux kernel, the drm/msm/adreno driver fixes a userspace-triggered crash on a2xx–a4xx by adding a guard in adreno_get_param() to check for UBWC configuration and return sane defaults when UBWC params are queried but not supported. Before this, older generations wouldn’t fetch UBWC params,...

CVE-2026-64048

The CVE-2026-64048 issue is in the Linux kernel SMC-D client (net/smc). A remote peer can reply with CHID 0 to a SMC-Dv2 proposal, matching an empty ism_dev slot and causing ini->ism_selected to 0. This can lead to a NULL pointer dereference in smc_conn_create() when dereferencing ism_dev[0]-&...

CVE-2026-64046

CVE-2026-64046 concerns a Linux kernel TLS issue where a chain-after-chain in the scatterlist could arise when end = 0 (start != 0). The bug creates a chain link to the content type immediately after the wrap link, and sg_next does not recursively resolve consecutive chain links, making the input...

CVE-2026-64047

The CVE-2026-64047 issue is in the Linux kernel’s net: tls code, specifically an off-by-one in sg_chain entry counting for the wrapped sk_msg scatterlist ring. When sg.end

CVE-2026-64045

CVE-2026-64045 (Linux kernel, ovpn tcp close race) : The vulnerability stems from ovpn_tcp_close() loading the ovpn_socket pointer under RCU read-lock, then using sock->peer after releasing the lock, while ovpn_socket_release() may detach the socket concurrently. The fix tightens the pattern b...

CVE-2026-64044

Concrete details confirm CVE-2026-64044 fix in the Linux kernel’s OpenVPN peer handling. The error path in ovpn_nl_peer_new_doit() previously called ovpn_peer_release() directly instead of ovpn_peer_put(), bypassing the kref, risking use-after-free when a caller holds a ref during an in-flight op...

CVE-2026-64043

The CVE-2026-64043 entry describes a race condition in the Linux kernel related to ovpn interfaces. During deletion of an ovpn netdevice, a CMD_PEER_NEW netlink message could race with the unregistration process, taking a fresh reference to the netdev and leaving the device in a state where it ca...

CVE-2026-64042

The CVE-2026-64042 issue affects the Linux kernel’s VFIO PCI path, where a DMABUF export could reveal BAR resources that were not properly reserved. The root cause is a missing guard in the DMABUF-creation path, allowing access to unreserved BAR resources via the export. The public description no...

CVE-2026-64040

CVE-2026-64040 affects the Linux kernel’s cachefiles path. The root cause is that when vfs_mkdir() fails, the error code was not extracted from the error pointer, causing mkdir_error to be reached with ret=0 and returning ERR_PTR(0) (NULL) instead of a proper error pointer. The public description...

CVE-2026-64041

The issue CVE-2026-64041 affects the Linux kernel ASoC fs210x codec driver. In fs210x_effect_scene_info(), a string is copied with strscpy using strlen(SRC) + 1 (DST) instead of a bound-limited size, enabling a potential buffer overflow when strlen(SRC) >= sizeof(DST). The fix uses correct bou...

CVE-2026-64039

CVE-2026-64039 relates to the Linux kernel’s drm/msm/snapshot code, where dumping of unaligned regions caused issues because the snapshotting aligned data segments to 16 bytes. The fix removes length alignment and prints the last registers in the region more accurately; it also addresses a 16x me...

CVE-2026-64038

CVE-2026-64038 concerns the Linux kernel hwmon lm90 driver. In lm90_probe(), devm actions to cancel alert_work and report_work were registered before hwmon device registration. With devm cleanup in reverse order, the hwmon device could be freed first, allowing lm90_update_alarms() to dereference ...

CVE-2026-64037

Concrete details found: CVE-2026-64037 affects the Linux kernel’s wifi: iwlwifi: mld path. When AMSDU is disabled, max_tid_amsdu_len can be 1 (sentinel) and the code checks for zero but not for this sentinel, causing num_subframes to compute to 0 and gso_size to be 0. This triggers skb_gso_segmen...

CVE-2026-64035

The CVE-2026-64035 entry concerns the Linux kernel igc driver: igc_fpe_init_smd_frame() failed to set the tx buffer type for SMD frames, causing igc_tx_buffer entries to retain a stale XDP/XSK type. This can lead TX completion to follow an incorrect cleanup path. The fix is to set the buffer type...

CVE-2026-64036

The CVE-2026-64036 issue affects the Linux kernel cgroup/rstat path. The vuln arises because css_rstat_updated(), a BPF kfunc, accepts a caller-provided cpu value used for per-cpu rstat lookups without validating it against a valid CPU. A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON could...

CVE-2026-64034

The CVE concerns the Linux kernel net: mana TOCTOU in hwc_msg_id handling. In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arit...

CVE-2026-64033

CVE-2026-64033 describes a use-after-free in Linux kernel RDMA/rtrs path file cleanup. In rtrs_srv_create_path_files(), if an error occurs after sysfs root folders were created and srv_path->kobj initialized, cleanup calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sysfs_root...

CVE-2026-64032

The CVE-2026-64032 entry documents a Linux kernel use-after-free in bridge multicast snooping when removing a bridge port. The issue occurs when both per-port and per-{port, VLAN} multicast contexts become enabled on a single bridge port due to interactions between per-VLAN multicast snooping and...

CVE-2026-64031

CVE-2026-64031 relates to the Linux kernel erofs module and fixes a managed cache race for unaligned extents in compressed data. The race could occur when two threads race to add the same folio to the managed cache (z_erofs_bind_cache) while folio->private is still Z_EROFS_PREALLOCATED_FOLIO. ...

CVE-2026-64029

The provided reports describe a Linux kernel vulnerability in ALSA seq: UMP output teardown where seq_ump_process_event() borrows client->out_rfile.output without proper synchronization, allowing a rawmidi substream to be torn down while an event_input callback is active. The fix, as documente...

CVE-2026-64030

The CVE-2026-64030 entries describe a Linux kernel WiFi bug in mac80211 (ieee80211_ml_epcs) where link_id = 15 can read sdata->link[15] beyond the 0..14 range, causing a crash when processing an EPCS Enable Response from a WiFi 7 AP. A NULL-check slip and dereferencing link->sdata leads to ...

CVE-2026-64028

In the Linux kernel tracing subsystem, CVE-2026-64028 affects hist_field_name() in the fully-qualified VAR_REF/EXPR path: when snprintf() truncation returns NULL, callers mistakenly dereference NULL in strcat(expr, hist_field_name(field, 0)) and in a sort-key strcmp, potentially leading to NULL d...

CVE-2026-64027

The CVE-2026-64027 issue affects the Linux kernel net: shaper component (XArray-based marking of entries). A race occurs when a reader observes a VALID mark is later invalidated by a writer reusing a slot, potentially leading to a use-after-free if net_shaper_rollback() frees entries without obse...

CVE-2026-64026

CVE-2026-64026 affects the Linux kernel’s rxrpc path. The issue was addressed by removing in-place decryption in splice()-transmitted DATA packets and instead unconditionally copying the packet content into a dedicated bounce buffer, which is decrypted there and then copied to the final destinati...

CVE-2026-64025

CVE-2026-64025 affects Linux kernel BPF plumbing where a TLS RX context could cause a use-after-free-like condition in data-path when a socket is inserted into a sockmap before TLS RX is configured. The issue arises because sk_psock_verdict_data_ready() does not guard against TLS RX ownership of ...

CVE-2026-64024

CVE-2026-64024 concerns a Linux kernel issue where a per-CPU tcp_tw_isn leak could enable ISN prediction. The root cause was that TIME_WAIT-derived ISNs were stored in a per-CPU variable and could be consumed by a subsequent SYN if a packet was dropped along several paths (e.g., min_ttl/min_hop, ...

CVE-2026-64022

The CVE-2026-64022 entry concerns the Linux kernel GPIO aggregator. The issue is that a dynamic software node created for the aggregator platform device (used with configfs) is leaked during device teardown. The fix is to destroy the software node as the last step in the tear-down path. Affected ...

CVE-2026-64023

Summary of CVE-2026-64023 (Linux kernel GPIO aggregator use-after-free) Affected component: the kernel’s GPIO aggregator code. The vulnerability arises from a race during cleanup: on error, the code frees aggr->lookups->dev_id before removing the corresponding entry from the lookup table. I...

CVE-2026-64021

The CVE concerns the Linux kernel DRM subsystem (drm/xe/oa). The issue occurs in xe_oa_stream_open_ioctl() when param.exec_q->width > 1: it returns -EOPNOTSUPP directly, bypassing the err_exec_q cleanup path, causing a leaked reference from xe_exec_queue_lookup() and preventing the file’s p...

CVE-2026-64020

The CVE-2026-64020 entry concerns the Linux kernel, specifically the nvme-pci driver. The issue was a leak of dma_vecs allocated for peer-to-peer (P2P) memory that was not unmapped, causing leakage on completion. Documents describe that the fix prevents the leak by addressing how dma_vecs are han...

CVE-2026-64019

Technical details are not publicly available in the provided documents; monitor for updates.

CVE-2026-64018

The Linux kernel vulnerability CVE-2026-64018 affects net: mana: validate rx_req_idx to prevent out-of-bounds array access. Root cause: mana_hwc_rx_event_handler() uses rx_req_idx derived from sge->address in DMA-coherent memory, and in Confidential VMs (SEV-SNP/TDX) this memory is shared unen...